3759744039346620e9613f40f90e8f318e5f54ad49c070e2bd23b667f7e65bf6 | Triage

Resubmissions

26/03/2025, 02:56

250326-dfb8lswwhz 7

26/03/2025, 02:55

250326-depsbawwht 3

Analysis

max time kernel
443s
max time network
550s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
26/03/2025, 02:55

Sharing

Report Analysis Logs

General

Target

Mercurial.Grabber.v1.03.rar
Size

2.9MB
MD5

635903bad1ada856d701f34d3070ccd9
SHA1

3ff98d91b9a3a47bf9f64bdf161efb9c5ac99fb0
SHA256

3759744039346620e9613f40f90e8f318e5f54ad49c070e2bd23b667f7e65bf6
SHA512

fee2c64124c47bcb1251b7b87969a1ff493e24bc196633e3a301565b126f5ed2e2967d4d1426ff5d9be9466c852bacf405229308acf946368e00ca887a4ef015
SSDEEP

49152:lYtbFd+FwSjhWaqv7yBSw9i4b1g8lDZxu0TR9TlqdqjxaNOH:qkwSVef4NDW8qEfH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2696	7zFM.exe
Token: 35	2696	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Mercurial.Grabber.v1.03.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads